CVE-2026-112177: Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8
A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process.
Other sources
A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The fix for CVE-2019-14869 was omitted when the package was rebased from version 9.25 to 9.27, reintroducing three privileged .forceput calls in the .charkeys procedure in Resource/Init/gsttf.ps. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which systems are affected?
The flaw affects Ghostscript as shipped with Red Hat Enterprise Linux 8. The issue was reintroduced during the package rebase from version 9.25 to 9.27.
What must an attacker do to exploit this issue?
An attacker needs Ghostscript to process a specially crafted PostScript file. No authentication or user interaction is indicated by the supplied severity vector.
What is the impact if exploitation succeeds?
The attacker may bypass -dSAFER restrictions, access files outside permitted paths, or execute commands with the permissions of the Ghostscript process.
Are -dSAFER-enabled deployments protected?
No. The vulnerability specifically bypasses -dSAFER restrictions because privileged .forceput operations in the .charkeys procedure are insufficiently protected.